RE: Panda ActiveScan false positive with Nessus .nasl files
"Pedro Bustamante" <[email protected]> Wed, 16 Aug 2006 15:42:34 +0200
| Newsgroups | gmane.comp.security.virus,gmane.comp.security.basics,gmane.comp.security.penetration |
|---|---|
| Message-ID | <84ECAF53A2F0F045BD9B7FD0FC56A0BD032F6DFA@ESMADEXH02.MADRID.PANDASOFTWARE.LOCAL> |
> Recently I checked mi winXP system with Panda online ActiveScan, > and I think it has found some false positive when checking some > nessus's .nasl files: > Virus:Linux/Test10879 > Disinfected > C:\Documents and Settings\FALSEUSER\Mis documentos\ FALSEPATH > \nessus-installer.sh[nessus.tar.gz][nessus.tar][nessus- > plugins/scripts/port_shell_execution.nasl] > I am curious about the first file's "DISINFECTED" status. In the case of port_shell_execution.nasl the Panda ActiveScan message is misleading. Droppers cannot be disinfected, only deleted. Viruses can be disinfected. Linux/Test10879 is marked as a dropper, so therefore the "disinfection" message you're seeing actually means that the file was deleted. Anyhow, it has now been fixed. > Hacktool:DoS/42zip Not disinfected C:\Documents and Settings\ > FALSEUSER \Mis documentos\FALSEPATH\nessus- > installer.sh[nessus.tar.gz][nessus.tar][nessus-plugins/ > scripts/smtp_AV_42zip_DoS.nasl][42.zip] Regarding smtp_AV_42zip_DoS.nasl the detection is correct. Most AVs today will scan base64 embedded files with text files. Regards, Pedro Bustamante Panda Software International www.pandasoftware.com